Certified Network Defender (CND) v2 Exam (312-38) — Questions and Answers

Question 1: Which vulnerability management metric measures the average time between when a vulnerability is discovered and when it is fully remediated?

Vulnerability Density Score
Mean Time to Detect (MTTD)
Patch Compliance Rate
Mean Time to Remediate (MTTR) (Correct answer)

Correct answer: Mean Time to Remediate (MTTR)

Mean Time to Remediate (MTTR) tracks how long it takes on average to fix vulnerabilities after discovery, and is a key KPI for vulnerability management program effectiveness.

Question 2: In Certified Network Defender, what is the PRIMARY purpose of conducting an initial assessment?

To fulfill administrative paperwork requirements
To establish a baseline and identify needs for appropriate action (Correct answer)
To generate documentation for billing purposes
To demonstrate the assessor's expertise

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline of current conditions and identifies specific needs. This foundational information guides all subsequent decisions, planning, and interventions.

Question 3: Why is compliance important in cybersecurity?

To avoid paying for software licenses
To increase the risk of noncompliance penalties
To simplify network infrastructure
To ensure legal and regulatory standards are met, protecting data and avoiding penalties (Correct answer)

Correct answer: To ensure legal and regulatory standards are met, protecting data and avoiding penalties

Compliance is crucial in cybersecurity because it ensures organizations adhere to legal, regulatory, and industry standards, such as GDPR or HIPAA. Meeting these requirements helps protect sensitive data, maintain customer trust, and avoid significant legal penalties and reputational damage. Compliance frameworks often mandate robust security practices, thereby strengthening an organization's overall security posture.

Question 4: What is the role of a Certificate Revocation List (CRL) in PKI?

List certificates no longer trusted before expiry (Correct answer)
Store issued certificates
Encrypt private keys
Validate certificate chain length

Correct answer: List certificates no longer trusted before expiry

A CRL is a signed list published by a CA containing serial numbers of certificates that have been revoked before their expiration.

Question 5: Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?

Wireshark + Burp Suite
Airsnort + John the Ripper
Nmap + Metasploit
Kismet + GPS receiver (Correct answer)

Correct answer: Kismet + GPS receiver

Kismet is a passive wireless network detector and sniffer, and when combined with a GPS receiver it can map discovered networks geographically, which is the core capability used in wardriving.

Question 6: A network defender discovers an unauthorized device is responding to ARP requests for the default gateway IP. Which attack is occurring?

DHCP Starvation
DNS Cache Poisoning
ARP Spoofing/Poisoning (Correct answer)
IP Spoofing

Correct answer: ARP Spoofing/Poisoning

ARP Spoofing involves sending fake ARP replies to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Question 7: An organization implements multi-factor authentication to reduce the risk of credential theft. This is an example of which type of risk control?

Preventive control (Correct answer)
Compensating control
Corrective control
Detective control

Correct answer: Preventive control

Preventive controls are designed to stop security incidents before they occur; MFA prevents unauthorized access by requiring additional verification.

Question 8: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Focus resources only on the largest tasks
Keep significant reserves without deployment
Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Allocate all resources equally regardless of need

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Effective resource allocation requires matching available resources to priorities determined by assessment of needs, risk factors, and strategic goals. This ensures that critical areas receive appropriate support while maintaining overall efficiency.

Question 9: What is the MOST important factor to consider when selecting assessment tools for CND certification work?

Personal familiarity with the tool
Validity, reliability, and appropriateness for the specific context (Correct answer)
How quickly the tool can be administered
The cost of the assessment tool

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid (measuring what they claim to measure), reliable (producing consistent results), and appropriate for the specific context and population. These psychometric properties ensure the quality of assessment outcomes.

Question 10: Which countermeasure directly protects against evil twin attacks by cryptographically binding the network identity to the authentication exchange?

Enabling MAC address filtering on the legitimate AP
Using certificate-based mutual authentication (EAP-TLS) with 802.1X (Correct answer)
Setting maximum transmit power to overpower the rogue AP
Hiding the SSID in beacon frames

Correct answer: Using certificate-based mutual authentication (EAP-TLS) with 802.1X

EAP-TLS requires the authentication server to present a certificate the client validates, so a rogue AP cannot complete the mutual auth exchange — the client detects the missing or invalid server certificate and refuses to connect.

Question 11: In network forensics, what does 'log normalization' refer to?

Converting logs from different sources into a common format (Correct answer)
Deleting redundant log entries
Compressing log archives
Encrypting log files at rest

Correct answer: Converting logs from different sources into a common format

Log normalization transforms heterogeneous log formats from various devices and applications into a unified schema for consistent analysis.

Question 12: What is the function of Intrusion Detection Systems (IDS)?

To prevent all network traffic
To prevent attacks by blocking incoming traffic
To scan emails for viruses
To monitor and alert on suspicious activities or breaches (Correct answer)

Correct answer: To monitor and alert on suspicious activities or breaches

Intrusion Detection Systems (IDS) are security tools that continuously monitor network or system activities for malicious activities or policy violations. When suspicious patterns or known attack signatures are detected, an IDS generates alerts to security personnel. Its primary role is to detect and notify, rather than to actively block traffic.

Question 13: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To bypass educational requirements
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment in the field

Correct answer: To demonstrate verified competency and adherence to professional standards

Professional certification demonstrates that an individual has met established competency standards through verified assessment. It provides assurance to employers, clients, and the public that the certified professional possesses the knowledge and skills required for competent practice.

Question 14: What is the PRIMARY benefit of using data-driven decision making in Certified Network Defender management?

It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It eliminates the need for professional judgment
It simplifies the decision-making process to one approach
It guarantees positive results for every decision

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decision making provides objective evidence that supports more informed decisions, helps reduce personal bias, and enables tracking of outcomes to evaluate effectiveness. It complements, rather than replaces, professional judgment.

Question 15: What is the role of a CVE (Common Vulnerabilities and Exposures) identifier in vulnerability management?

It tracks the patch status of vulnerabilities across vendor systems
It automatically generates remediation scripts for known vulnerabilities
It assigns a severity score from 0 to 10 for each vulnerability
It provides a unique, standardized reference number for publicly known vulnerabilities (Correct answer)

Correct answer: It provides a unique, standardized reference number for publicly known vulnerabilities

CVE identifiers provide a unique, standardized naming convention for publicly known vulnerabilities, enabling consistent communication across tools and organizations.

Question 16: How does continuous monitoring support risk management?

By slowing down network performance to prevent breaches
By preventing all network traffic
By providing real-time detection of threats and enabling proactive risk mitigation (Correct answer)
By blocking all incoming data packets

Correct answer: By providing real-time detection of threats and enabling proactive risk mitigation

Continuous monitoring supports risk management by providing ongoing, real-time visibility into an organization's security posture and potential threats. This constant oversight allows for immediate detection of anomalies, vulnerabilities, and active attacks, enabling proactive risk mitigation before significant damage occurs. It ensures that security controls remain effective and adapt to evolving threat landscapes.

Question 17: What is the primary security weakness of Wired Equivalent Privacy (WEP)?

It requires 802.1X which is difficult to implement
It relies on RC4 with static, reused initialization vectors making it trivially crackable (Correct answer)
It uses 128-bit keys which are too long to be practical
It lacks mutual authentication but provides strong encryption

Correct answer: It relies on RC4 with static, reused initialization vectors making it trivially crackable

WEP reuses 24-bit IVs and uses a flawed implementation of RC4, allowing attackers to collect enough packets to statistically recover the key in minutes using tools like Aircrack-ng.

Question 18: When conducting a wireless site survey for security planning, what is the primary purpose of measuring RF signal coverage patterns?

To identify the DHCP scope needed for wireless clients
To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited (Correct answer)
To configure the correct 802.11 amendment on each access point
To determine the number of user licenses needed for the WLAN controller

Correct answer: To locate coverage gaps and signal bleed beyond the facility perimeter that could be exploited

RF site surveys help defenders understand where the wireless signal extends, ensuring coverage gaps do not create blind spots and that signal does not bleed significantly outside the building where attackers could intercept it.

Question 19: What is the purpose of a threat intelligence platform (TIP) in a network defender's toolkit?

To automatically patch vulnerabilities identified by scanners
To block all inbound traffic from known threat actors
To aggregate, correlate, and analyze threat data from multiple sources to support proactive defense (Correct answer)
To generate compliance reports for auditors

Correct answer: To aggregate, correlate, and analyze threat data from multiple sources to support proactive defense

A TIP centralizes threat intelligence from various feeds and sources, allowing security teams to correlate data and make informed decisions about defenses and incident response.

Question 20: An organization uses threat intelligence feeds to identify indicators of compromise (IoCs). Which of the following is an example of an IoC?

A weak password policy
A known malicious IP address communicating with internal hosts (Correct answer)
An open port on a firewall
An unpatched operating system

Correct answer: A known malicious IP address communicating with internal hosts

Indicators of compromise (IoCs) are artifacts such as malicious IP addresses, domain names, or file hashes that indicate a system has been breached or is under attack.

Question 21: A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?

Identification (Correct answer)
Containment
Preparation
Eradication

Correct answer: Identification

The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.

Question 22: What role does communication play in disaster recovery?

To confuse users and prevent recovery
To keep stakeholders informed and coordinated during recovery (Correct answer)
To stop the recovery efforts until further analysis is completed
To limit communication to only internal teams

Correct answer: To keep stakeholders informed and coordinated during recovery

Effective communication is vital during disaster recovery to ensure all involved parties, from technical teams to senior management and external stakeholders, are informed and coordinated. This prevents confusion, manages expectations, and facilitates a smooth, synchronized effort to restore operations. Clear communication ensures everyone understands their roles and the current status of recovery efforts.

Question 23: Which GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes?

Data minimization
Storage limitation
Integrity and confidentiality
Purpose limitation (Correct answer)

Correct answer: Purpose limitation

The GDPR principle of purpose limitation restricts organizations from using personal data for purposes beyond what was originally specified at collection.

Question 24: In network forensics, what is the purpose of 'packet carving'?

Reconstructing files and data from raw packet streams (Correct answer)
Splitting large PCAP files into smaller segments
Encrypting captured packets for storage
Filtering packets by protocol type

Correct answer: Reconstructing files and data from raw packet streams

Packet carving reconstructs files, images, or documents from reassembled packet payloads captured in a PCAP file.

Question 25: Which protocol is used by 802.1X network access control to authenticate devices before they are allowed onto the network?

SNMP
EAP (Extensible Authentication Protocol) (Correct answer)
ARP
ICMP

Correct answer: EAP (Extensible Authentication Protocol)

802.1X uses EAP over LAN (EAPOL) to authenticate supplicants (clients) via an authenticator (switch/AP) to an authentication server (typically RADIUS).

Question 26: Which business continuity concept identifies which business processes are most critical and must be restored first after a disaster?

Business Impact Analysis (BIA) (Correct answer)
Risk Register
Gap Analysis
Vulnerability Assessment

Correct answer: Business Impact Analysis (BIA)

A Business Impact Analysis (BIA) identifies critical business functions, quantifies the impact of disruptions, and prioritizes recovery order based on operational and financial consequences.

Question 27: An organization's vulnerability management program uses credentialed scanning. What is the primary advantage over non-credentialed scanning?

It identifies more vulnerabilities by authenticating to systems and inspecting internal configurations (Correct answer)
It is faster because it skips authentication overhead
It requires no network access to the target system
It avoids triggering IDS/IPS alerts during the scan

Correct answer: It identifies more vulnerabilities by authenticating to systems and inspecting internal configurations

Credentialed (authenticated) scanning logs into target systems to check patch levels, configurations, and installed software, discovering vulnerabilities that unauthenticated scans miss.

Question 28: Which of the following is a best practice for ensuring log integrity in a forensic context?

Disable logging on high-traffic systems to reduce noise
Store logs only on the monitored host
Forward logs in real time to a remote write-once log server (Correct answer)
Rotate logs every hour and delete the previous copy

Correct answer: Forward logs in real time to a remote write-once log server

Forwarding logs in real time to an isolated, write-once remote server prevents attackers who compromise the source system from tampering with log evidence.

Question 29: Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?

BIAS (Bluetooth Impersonation Attack)
BlueSmack
Bluesnarfing (Correct answer)
Bluejacking

Correct answer: Bluesnarfing

Bluesnarfing exploits vulnerabilities in OBEX Push Profile or OBEX File Transfer Profile to access sensitive data on a Bluetooth device without user authorization or authentication.

Question 30: What is the purpose of a security baseline configuration for endpoints?

Configure network routing tables
Define the maximum performance settings
Establish a minimum secure configuration standard all endpoints must meet (Correct answer)
Determine which users can access the endpoint

Correct answer: Establish a minimum secure configuration standard all endpoints must meet

A security baseline defines the minimum required security settings—such as password policies, enabled services, and audit logging—that every endpoint in the organization must comply with.

Question 31: What is the purpose of Network Address Translation (NAT) from a security perspective?

It monitors packets for malicious signatures
It encrypts network traffic between hosts
It hides internal IP addresses from external networks (Correct answer)
It authenticates users before granting network access

Correct answer: It hides internal IP addresses from external networks

NAT translates private internal IP addresses to a public IP address, effectively hiding the internal network topology from external observers.

Question 32: Which document provides pre-approved procedures for responding to common incident types, reducing decision fatigue during an active incident?

Business impact analysis
Security awareness policy
Playbook (runbook) (Correct answer)
Risk assessment report

Correct answer: Playbook (runbook)

Playbooks are pre-defined, step-by-step response procedures for specific incident scenarios that allow responders to act quickly and consistently without improvising under pressure.

Question 33: What does 'log retention policy' define in an enterprise security program?

How logs are encrypted in transit
How long logs must be stored before deletion (Correct answer)
The format logs are stored in
Who can create new log sources

Correct answer: How long logs must be stored before deletion

A log retention policy specifies the minimum duration logs must be preserved to support forensic investigations, audits, and regulatory compliance.

Question 34: In NIST SP 800-30, what is the correct order of the risk assessment process?

Identify vulnerabilities, determine impact, identify threats, assess controls
Determine impact, identify threats, assess controls, determine likelihood
Identify threats, identify vulnerabilities, determine likelihood, determine impact (Correct answer)
Assess controls, identify threats, determine impact, identify vulnerabilities

Correct answer: Identify threats, identify vulnerabilities, determine likelihood, determine impact

NIST SP 800-30 follows: identify threats, identify vulnerabilities, determine likelihood, then determine impact to derive overall risk.

Question 35: A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?

Reimage all 200 workstations simultaneously
Pay the ransom to restore operations quickly
Disconnect affected systems from the network to prevent further spread (Correct answer)
Notify all employees about the attack via company email

Correct answer: Disconnect affected systems from the network to prevent further spread

Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.

Question 36: What is the purpose of a playbook (runbook) in a Security Operations Center?

A report template for executive security briefings
A documented, step-by-step procedure for responding to specific types of security incidents (Correct answer)
A document listing all network IP addresses and device inventories
A configuration guide for firewall rule creation

Correct answer: A documented, step-by-step procedure for responding to specific types of security incidents

SOC playbooks provide analysts with standardized, repeatable procedures for responding to specific incident types, ensuring consistent, efficient responses and reducing the chance of missed steps during high-pressure situations.

Question 37: In forensic investigations, what is 'write blocking' and why is it used?

Disabling write permissions on the SIEM to protect log integrity
Encrypting evidence before transport to the forensic lab
Using a hardware or software device to prevent any changes to the original evidence media (Correct answer)
Blocking network write operations to prevent lateral movement

Correct answer: Using a hardware or software device to prevent any changes to the original evidence media

A write blocker prevents any write operations to the original storage media during imaging, ensuring that the evidence remains unaltered and legally admissible.

Question 38: Which network segmentation control isolates traffic by assigning logical broadcast domains on a physical switch?

PAT
NAT
VLAN (Correct answer)
ACL

Correct answer: VLAN

VLANs (Virtual Local Area Networks) segment broadcast domains logically, limiting lateral movement between device groups.

Question 39: When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?

Netstat
Nmap
Wireshark
dd or dcfldd (Correct answer)

Correct answer: dd or dcfldd

Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.

Question 40: A network engineer wants to prevent rogue DHCP servers on a LAN. Which switch feature should be enabled?

Storm Control
Dynamic ARP Inspection
Port Security
DHCP Snooping (Correct answer)

Correct answer: DHCP Snooping

DHCP Snooping validates DHCP messages and restricts DHCP server responses to trusted ports only.

Question 41: Which firewall rule processing model checks rules sequentially and stops at the first match?

Best-match rule base
First-match rule base (Correct answer)
Weighted priority processing
Round-robin processing

Correct answer: First-match rule base

Most firewalls use a first-match (first-fit) rule processing model where rules are evaluated top-to-bottom and the first matching rule is applied, making rule ordering critical.

Question 42: Which federal law mandates that US government agencies implement information security programs and report to OMB annually?

SOX
HIPAA
FERPA
FISMA (Correct answer)

Correct answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement agency-wide information security programs.

Question 43: Why is it important to establish cybersecurity policies for an organization?

To provide clear rules for securing data and complying with regulations (Correct answer)
To reduce the number of employees working on security tasks
To increase the complexity of security measures
To make systems easier to hack

Correct answer: To provide clear rules for securing data and complying with regulations

Establishing cybersecurity policies provides clear, documented guidelines for employees on how to handle and protect organizational data and systems. These policies ensure consistent security practices across the organization, define responsibilities, and help ensure compliance with legal and regulatory requirements. They are essential for creating a strong security culture and framework.

Question 44: Which step of the NIST RMF involves categorizing information systems based on the potential impact of a security breach?

Authorize
Categorize (Correct answer)
Select
Implement

Correct answer: Categorize

The Categorize step uses FIPS 199 and NIST SP 800-60 to classify systems based on the potential impact (low, moderate, high) of a confidentiality, integrity, or availability breach.

Question 45: What is the MOST important leadership quality for a CND certified professional managing a team?

Achieving the highest personal performance metrics
Avoiding all forms of conflict within the team
Maintaining strict control over all decisions
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership in professional settings requires integrity to build trust, clear communication to align the team, and the ability to develop team members' skills and capabilities. These qualities create a productive and engaged team.

Question 46: Which scanning technique attempts to exploit discovered vulnerabilities to confirm their existence and measure actual risk?

Network mapping
Credentialed scanning
Exploitation-based scanning (Correct answer)
Passive scanning

Correct answer: Exploitation-based scanning

Exploitation-based scanning actively attempts to exploit identified vulnerabilities to confirm they are real and exploitable, providing a more accurate risk assessment.

Question 47: Which Syslog severity level (RFC 5424) indicates conditions that must be corrected immediately, such as a corrupted system database?

Level 1 - Alert (Correct answer)
Level 3 - Error
Level 2 - Critical
Level 0 - Emergency

Correct answer: Level 1 - Alert

Syslog severity Level 1 (Alert) indicates conditions that require immediate action, such as a loss of the primary ISP link or a corrupted database that needs instant attention.

Question 48: What is a zero-day vulnerability?

A vulnerability that is intentionally introduced into the system
A vulnerability that has been patched and is no longer a threat
A vulnerability that has been identified but not yet exploited
A vulnerability that is exploited immediately upon discovery, without a fix available (Correct answer)

Correct answer: A vulnerability that is exploited immediately upon discovery, without a fix available

A zero-day vulnerability is a software flaw that is unknown to the vendor or public and has no available patch or fix. Attackers can exploit these vulnerabilities "on day zero" of their discovery, often before the vendor is even aware of the issue. This makes zero-day exploits particularly dangerous as there is no immediate defense against them.

Question 49: What is the purpose of log normalization in a SIEM system?

Forwarding alerts to the incident response team
Encrypting logs to prevent tampering
Deleting old logs to free storage space
Converting logs from different sources into a common format for correlation (Correct answer)

Correct answer: Converting logs from different sources into a common format for correlation

Log normalization converts disparate log formats from different vendors and systems into a standardized schema, enabling the SIEM to correlate events across multiple data sources effectively.

Question 50: During threat assessment, the security team applies the 'threat × vulnerability × impact' formula. What does this calculation produce?

A risk rating for the identified threat scenario (Correct answer)
The number of exploits available for the vulnerability
The CVSS Base Score
The time-to-breach estimate

Correct answer: A risk rating for the identified threat scenario

Multiplying threat likelihood by vulnerability severity by potential impact produces a risk rating that helps prioritize which issues require the most urgent attention.

Question 51: When assessment results for a Certified Network Defender evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Conduct additional assessment using alternative methods (Correct answer)
Discard the results and start over completely
Delay reporting until results are favorable

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods to gather more data. This triangulation approach helps clarify findings without compromising the integrity of the assessment process.

Question 52: Which security protocol is used by RADIUS to encrypt only the user password field in authentication packets?

MD5 with a shared secret (Correct answer)
SHA-256 HMAC
AES-256
RC4 with a session key

Correct answer: MD5 with a shared secret

RADIUS encrypts only the password using MD5 XOR with a shared secret, while the rest of the packet is sent in cleartext.

Question 53: What does EDR (Endpoint Detection and Response) provide beyond traditional antivirus?

Only signature-based malware scanning
Patch deployment across endpoints
Firewall rule management
Continuous behavioral monitoring, threat hunting, and incident response capabilities (Correct answer)

Correct answer: Continuous behavioral monitoring, threat hunting, and incident response capabilities

EDR solutions monitor endpoint behavior continuously, detect anomalies indicative of advanced threats, and provide tools for investigation and remediation.

Question 54: A penetration tester discovers that an organization's web application allows SQL injection. In the threat modeling context, what does this represent?

A threat
A risk
An exploit
A vulnerability (Correct answer)

Correct answer: A vulnerability

SQL injection is a vulnerability — a weakness in the system that can be exploited; the actual attack attempt would be the threat.

Question 55: A chain of custody document in incident response is primarily used to:

Record which analysts were on call during the incident
Log system performance metrics during recovery
Track evidence handling to ensure its integrity and admissibility in legal proceedings (Correct answer)
Document software licenses used during the investigation

Correct answer: Track evidence handling to ensure its integrity and admissibility in legal proceedings

Chain of custody records every person who handled evidence, when, and why, ensuring that evidence integrity can be proven in court or disciplinary proceedings.

Question 56: What does a stateful firewall track that a stateless packet filter does not?

Connection state and session context (Correct answer)
TCP/UDP port numbers
Source and destination IP addresses
Protocol type in the IP header

Correct answer: Connection state and session context

Stateful firewalls maintain a state table tracking active connections, allowing return traffic without explicit rules.

Question 57: What is 'patch management' and why is it critical for endpoint security?

Replacing hardware components on schedule
Regularly applying security updates to fix known vulnerabilities before attackers exploit them (Correct answer)
Installing new features to improve productivity
Backing up endpoint configurations

Correct answer: Regularly applying security updates to fix known vulnerabilities before attackers exploit them

Patch management ensures that known software vulnerabilities are remediated promptly, closing the window of exploitation before attackers can leverage public exploit code.

Question 58: Which MITRE framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to inform threat assessments and detection strategies?

CVE Database
MITRE ATT&CK (Correct answer)
NIST NVD
CWE List

Correct answer: MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary behaviors organized by tactics and techniques, used to model threats and improve detection and response capabilities.

Question 59: Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?

Registry hive backups
Contents of RAM (memory dump) (Correct answer)
Prefetch files from the filesystem
Event log files from disk

Correct answer: Contents of RAM (memory dump)

RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.

Question 60: Which CND control specifically addresses preventing unauthorized software execution on endpoints through policy-based restrictions?

Dynamic Host Configuration Protocol (DHCP)
Intrusion Detection System (IDS)
Software Restriction Policies (SRP) or AppLocker (Correct answer)
Network Access Control (NAC)

Correct answer: Software Restriction Policies (SRP) or AppLocker

Windows Software Restriction Policies and AppLocker enforce rules that allow or deny execution of applications based on path, publisher certificate, or file hash.

Question 61: What is the key difference between IDS and IPS deployment in a network?

IPS is placed inline and can block traffic; IDS passively monitors (Correct answer)
IDS encrypts traffic; IPS does not
IPS only detects known signatures; IDS uses anomaly detection
IDS requires agent installation; IPS is agentless

Correct answer: IPS is placed inline and can block traffic; IDS passively monitors

IPS is deployed inline in the traffic path and can drop or modify packets, while IDS monitors a copy of traffic and only alerts.

Question 62: In a DR test scenario, a 'tabletop exercise' is best described as:

A full failover to the backup site with production traffic
Automated backup restoration test with verification
A discussion-based walkthrough of the DR plan without activating systems (Correct answer)
Hardware replacement drill under time pressure

Correct answer: A discussion-based walkthrough of the DR plan without activating systems

A tabletop exercise is a scenario-driven discussion where team members talk through their responses to a hypothetical disaster without actually executing any technical steps.

Question 63: Which foundational principle is MOST important for success in the Certified Network Defender profession?

Maintaining the minimum requirements for certification
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Specializing in only one narrow area of practice
Maximizing financial returns on every engagement

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success in any professional field requires a commitment to continuous learning to stay current, ethical practice to maintain trust and integrity, and a focus on quality outcomes that serve stakeholders and the public interest.

Question 64: In risk management, the 'residual risk' is best described as:

The initial risk before any assessment is conducted
Risk that has been completely eliminated by security controls
Risk that remains after security controls have been applied (Correct answer)
Risk transferred to a third-party insurer

Correct answer: Risk that remains after security controls have been applied

Residual risk is the level of risk that remains after risk mitigation controls have been implemented; it must be accepted by management.

Question 65: What is the role of backups in disaster recovery?

To restore lost or damaged data and systems to their previous state (Correct answer)
To make the recovery process slower
To prevent any data loss during a disaster
To delete the most recent data from the system

Correct answer: To restore lost or damaged data and systems to their previous state

Backups are fundamental to disaster recovery as they provide copies of data and system configurations. In the event of data loss, corruption, or system failure due to a disaster, these backups allow an organization to restore its critical information and systems to a functional state. This capability is essential for minimizing downtime and ensuring business continuity.

Question 66: In a SOC (Security Operations Center), what is the role of a Tier 1 analyst?

Performing threat hunting and advanced forensics
Monitoring alerts, triaging events, and escalating confirmed incidents (Correct answer)
Managing executive-level security reporting
Developing new detection rules and SIEM use cases

Correct answer: Monitoring alerts, triaging events, and escalating confirmed incidents

Tier 1 SOC analysts monitor security dashboards, review and triage incoming alerts, filter false positives, and escalate validated incidents to Tier 2 for deeper investigation.

Question 67: What is the significance of timestamps in log analysis during a forensic investigation?

They compress log data
They encrypt log entries
They establish the sequence and timing of events (Correct answer)
They determine log file size

Correct answer: They establish the sequence and timing of events

Accurate timestamps allow investigators to build a chronological timeline correlating events across multiple systems.

Question 68: Port security on a network switch is primarily used to defend against which type of attack?

MAC flooding attacks (Correct answer)
DNS poisoning
Man-in-the-middle via TLS stripping
SQL injection

Correct answer: MAC flooding attacks

Port security limits the number of MAC addresses allowed on a switch port, preventing MAC flooding attacks that attempt to overflow the CAM table and cause the switch to broadcast all traffic.

Question 69: What is the primary benefit of implementing a centralized log management solution (like a SIEM) over reviewing logs on individual systems?

It eliminates the need for endpoint security solutions
It enables cross-system correlation to identify attack patterns spanning multiple devices (Correct answer)
It automatically remediates detected security issues
It reduces the storage space required for logs

Correct answer: It enables cross-system correlation to identify attack patterns spanning multiple devices

Centralized log management allows security analysts to correlate events across multiple systems, making it possible to detect multi-stage attacks that would appear innocuous when viewed in isolation on individual devices.

Question 70: Which EAP method provides the strongest security by requiring both the client and the authentication server to present digital certificates?

EAP-TLS (Correct answer)
EAP-MD5
LEAP
EAP-FAST

Correct answer: EAP-TLS

EAP-TLS requires mutual certificate-based authentication — both the supplicant and the RADIUS server present X.509 certificates — making it immune to password-based attacks and the most secure EAP method.

Question 71: What is the primary purpose of risk management in cybersecurity?

To assess, prioritize, and mitigate risks to protect systems and data (Correct answer)
To ignore potential threats
To increase the likelihood of security breaches
To delay response to security incidents

Correct answer: To assess, prioritize, and mitigate risks to protect systems and data

The primary purpose of risk management in cybersecurity is to proactively identify, analyze, and evaluate potential threats and vulnerabilities to an organization's assets. By assessing the likelihood and impact of these risks, organizations can prioritize and implement appropriate controls and mitigation strategies. This systematic approach aims to protect systems and data from harm while aligning with business objectives.

Question 72: What is the difference between a vulnerability and a threat in network security?

There is no difference, they are the same
A vulnerability and a threat are both external factors
A vulnerability is a threat that has already been exploited
A vulnerability is a weakness, and a threat is something that exploits that weakness (Correct answer)

Correct answer: A vulnerability is a weakness, and a threat is something that exploits that weakness

In network security, a vulnerability refers to a weakness or flaw in a system, application, or process that could be exploited. A threat, on the other hand, is a potential danger or actor (e.g., a hacker, malware) that could exploit that weakness to cause harm. Understanding this distinction is key to effective risk management, as vulnerabilities are what you fix, and threats are what you defend against.

Question 73: What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To satisfy a personal achievement goal
To guarantee employment in the field
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Question 74: Which VPN protocol operates at Layer 2 and is commonly used to extend VLANs across WAN connections?

IPsec
OpenVPN
L2TP (Correct answer)
MPLS

Correct answer: L2TP

L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 and is often paired with IPsec for security to create secure tunnels.

Question 75: What is the PRIMARY benefit of using data-driven decision making in Certified Network Defender management?

It eliminates the need for professional judgment
It guarantees positive results for every decision
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It simplifies the decision-making process to one approach

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Question 76: What does the term 'attack surface' refer to in threat assessment?

The time window during which a system is vulnerable
The total set of different points where an attacker could enter or extract data from an environment (Correct answer)
The geographic area from which attacks originate
The number of active exploits targeting a system

Correct answer: The total set of different points where an attacker could enter or extract data from an environment

The attack surface encompasses all the different points (network interfaces, APIs, user inputs, etc.) where an unauthorized user could attempt to enter or extract data.

Question 77: Which log source is most critical for detecting brute force login attempts against Windows Active Directory?

DNS query logs
Application event logs
DHCP lease logs
Windows Security Event Logs (Event ID 4625) (Correct answer)

Correct answer: Windows Security Event Logs (Event ID 4625)

Windows Security Event ID 4625 records failed logon attempts, and repeated failures from a single source against AD accounts are the primary indicator of a brute force attack.

Question 78: Which compliance framework specifically addresses the security of payment card data?

HIPAA
SOX
GLBA
PCI DSS (Correct answer)

Correct answer: PCI DSS

PCI DSS (Payment Card Industry Data Security Standard) mandates security controls for organizations that handle credit and debit card transactions.

Question 79: An organization discovers a vulnerability but decides no action is needed because the cost of mitigation exceeds the asset's value. This decision is an example of:

Risk mitigation
Risk avoidance
Risk acceptance (Correct answer)
Risk transference

Correct answer: Risk acceptance

Risk acceptance (also called risk retention) occurs when management consciously chooses to accept a risk, often because mitigation costs outweigh potential loss.

Question 80: Which compliance regulation applies to US financial institutions and requires them to protect the security and confidentiality of customer financial information?

GLBA (Correct answer)
COPPA
FISMA
FERPA

Correct answer: GLBA

The Gramm-Leach-Bliley Act (GLBA) requires US financial institutions to implement safeguards to protect nonpublic personal financial information.

Question 81: Which Windows artifact is most useful for determining which programs were recently executed on a system?

System32 folder
Boot.ini
Hosts file
Prefetch files (Correct answer)

Correct answer: Prefetch files

Windows Prefetch files (.pf) record execution metadata including timestamps and run counts for recently launched programs.

Question 82: What is the BEST strategy for resource allocation in Certified Network Defender project management?

Match resources to priorities based on assessment of needs, risks, and strategic goals (Correct answer)
Keep significant reserves without deployment
Focus resources only on the largest tasks
Allocate all resources equally regardless of need

Correct answer: Match resources to priorities based on assessment of needs, risks, and strategic goals

Question 83: What is the primary function of a Demilitarized Zone (DMZ) in a network?

To prevent all external network traffic
To store backup data securely
To protect the network from internal attacks
To provide a secure zone for public-facing services while protecting internal networks (Correct answer)

Correct answer: To provide a secure zone for public-facing services while protecting internal networks

A Demilitarized Zone (DMZ) is a perimeter network that separates an organization's internal local area network (LAN) from an untrusted external network, like the internet. It hosts public-facing services such as web servers, email servers, and DNS servers. This design allows external users to access these services without directly exposing the internal network, adding an extra layer of security.

Question 84: Why is employee training important in incident response?

To delay incident response by creating confusion
To increase the number of people involved in the incident response
To ensure staff know how to respond to an incident and support recovery efforts (Correct answer)
To prevent users from reporting issues

Correct answer: To ensure staff know how to respond to an incident and support recovery efforts

Employee training is critical in incident response because human error is often a significant factor in security incidents. Well-trained staff can recognize potential threats, follow established protocols, and contribute effectively to containment and recovery efforts. This proactive approach empowers employees to act as a strong first line of defense, minimizing the impact of incidents.

Question 85: A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?

Enabling WPA3 protection on the access point
Enabling band steering to push clients to 5 GHz
Implementing 802.1X port-based authentication
Hiding the network name to reduce casual discovery (SSID cloaking) (Correct answer)

Correct answer: Hiding the network name to reduce casual discovery (SSID cloaking)

SSID cloaking (hiding) sets the SSID field to null in beacon frames, making the network invisible to casual scanners; however, passive sniffers can still capture the SSID from probe requests and responses.

Question 86: KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?

The RADIUS authentication exchange
The initial beacon and probe response exchange
The DHCP IP address assignment process
The 4-way handshake used to establish session keys (Correct answer)

Correct answer: The 4-way handshake used to establish session keys

KRACK manipulates retransmissions in the WPA2 4-way handshake to force nonce reuse, allowing decryption and potentially injection of traffic by reinstalling an already-in-use cryptographic key.

Question 87: Which risk analysis method uses expert opinion and descriptive ratings such as 'High,' 'Medium,' and 'Low' rather than numerical values?

Quantitative analysis
Delphi method
Monte Carlo simulation
Qualitative analysis (Correct answer)

Correct answer: Qualitative analysis

Qualitative risk analysis uses subjective ratings and expert judgment instead of precise monetary or numerical calculations.

Question 88: In a Business Impact Analysis (BIA), the Recovery Time Objective (RTO) defines:

The maximum tolerable data loss measured in time
The maximum acceptable downtime before business impact becomes critical (Correct answer)
The point in time to which data must be recovered
The cost to restore operations after a disaster

Correct answer: The maximum acceptable downtime before business impact becomes critical

RTO is the maximum acceptable length of time a system can be offline before the impact on the business becomes unacceptable.

Question 89: How does the CND body of knowledge relate to daily professional practice?

It only applies during certification exams
It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is relevant only for academic research
It is theoretical and has limited practical application

Correct answer: It provides the foundational framework that guides decision-making and standard practices

The body of knowledge provides the foundational framework of principles, standards, and best practices that professionals use to guide their daily decision-making, ensure consistent quality, and maintain alignment with industry standards.

Question 90: Which network security measure is used to authenticate users based on their physical characteristics?

Smartcards
Biometric authentication (Correct answer)
Username and password combinations
Password protection

Correct answer: Biometric authentication

Biometric authentication verifies a user's identity based on unique physical or behavioral characteristics. Examples include fingerprints, facial recognition, iris scans, or voice patterns. This method offers a high level of security because biometric traits are difficult to replicate or steal, making it a robust way to authenticate users.

Question 91: What is baseline monitoring in the context of network security operations?

Establishing normal network behavior patterns to identify anomalies (Correct answer)
Documenting all installed software versions
Running daily vulnerability scans against all systems
Creating backup copies of network configurations

Correct answer: Establishing normal network behavior patterns to identify anomalies

Baseline monitoring captures normal network traffic patterns, bandwidth usage, and system behavior so that deviations indicating potential security incidents can be detected.

Question 92: What is threat hunting in a security operations context?

Automated scanning of systems for known vulnerabilities
Responding to active security incidents as they are reported
Running penetration tests against production systems
Proactive searching through networks and endpoints to detect threats that evade automated detection (Correct answer)

Correct answer: Proactive searching through networks and endpoints to detect threats that evade automated detection

Threat hunting is a proactive, human-driven process where analysts search for indicators of compromise or attacker behaviors that automated tools may have missed, assuming a breach may already exist.

Question 93: How does the CND body of knowledge relate to daily professional practice?

It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It is theoretical and has limited practical application
It only applies during certification exams
It is relevant only for academic research

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 94: During post-incident analysis, what is the PRIMARY purpose of a 'lessons learned' meeting?

To notify regulators about the breach details
To assign blame to the team members who made errors
To calculate the total financial loss from the incident
To identify process gaps and improve defenses before the next incident (Correct answer)

Correct answer: To identify process gaps and improve defenses before the next incident

Lessons learned meetings focus on improving processes, tools, and training so that the organization responds more effectively to future incidents.

Question 95: How does the CND body of knowledge relate to daily professional practice?

It is theoretical and has limited practical application
It provides the foundational framework that guides decision-making and standard practices (Correct answer)
It only applies during certification exams
It is relevant only for academic research

Correct answer: It provides the foundational framework that guides decision-making and standard practices

Question 96: What is the function of a Security Information and Event Management (SIEM) system?

To block all external connections to the network
To monitor, detect, and respond to security incidents by analyzing event data (Correct answer)
To prevent users from accessing sensitive data
To store unencrypted sensitive data

Correct answer: To monitor, detect, and respond to security incidents by analyzing event data

A Security Information and Event Management (SIEM) system centralizes and analyzes security logs and event data from various sources across an organization's network. Its primary function is to provide real-time monitoring, detect suspicious activities, and alert security teams to potential threats or incidents. This enables rapid response and investigation, enhancing an organization's overall security posture.

Question 97: Which NIST publication provides guidance specifically on the Risk Management Framework (RMF)?

NIST SP 800-61
NIST SP 800-37 (Correct answer)
NIST SP 800-171
NIST SP 800-53

Correct answer: NIST SP 800-37

NIST SP 800-37 describes the Risk Management Framework (RMF) for federal information systems, outlining six steps from categorization to continuous monitoring.

Question 98: Under the NIST Cybersecurity Framework, which function covers activities to restore services impaired by a cybersecurity incident?

Identify
Respond
Recover (Correct answer)
Protect

Correct answer: Recover

The 'Recover' function encompasses activities to restore capabilities or services that were impaired during an incident, including communications and improvement plans.

Question 99: What is the primary goal of OS hardening in a network defender's role?

Reduce the attack surface by disabling unnecessary services and features (Correct answer)
Install the latest productivity software
Increase system performance
Enable remote desktop on all workstations

Correct answer: Reduce the attack surface by disabling unnecessary services and features

OS hardening removes or disables unused services, accounts, and features, reducing the number of potential vulnerabilities an attacker can exploit.

Question 100: Which statement BEST describes the relationship between Certified Network Defender certification requirements and industry evolution?

Changes only occur when government mandates new requirements
Certification requirements never change once established
Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards (Correct answer)
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge, technology, and practice standards

Certification requirements evolve to keep pace with advances in professional knowledge, technological developments, and changes in practice standards. This ensures that certified professionals remain current and competent in a changing professional landscape.

Certified Network Defender (CND) v2 Exam (312-38)

The CND certification validates the skills of network administrators to protect, detect, and respond to network attacks, ensuring network security.

100

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds